IBM DB2 Remote Denial of Service Vulnerabilities

Bugtraq ID:	33258
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-0173 CVE-2009-0172
Remote:	Yes
Local:	No
Published:	Jan 13 2009 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	IBM
Vulnerable:	IBM DB2 Universal Database 9.5 Fixpak 2 IBM DB2 Universal Database 9.5 Fix Pack 3a IBM DB2 Universal Database 9.5 Fix Pack 1 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database 9.1 Fix Pack 6a IBM DB2 Universal Database 9.1 Fix Pack 6 IBM DB2 Universal Database 9.1 Fix Pack 4a IBM DB2 Universal Database 9.1 IBM DB2 Universal Database 8.2 IBM DB2 Universal Database 8.1
Not Vulnerable:

IBM DB2 Remote Denial of Service Vulnerabilities

IBM DB2 is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the server and deny service to legitimate users.

These issues affect versions prior to DB2 9.1 FP6a, 9.5 FP3a, and 8.1 FP17a.

IBM DB2 Remote Denial of Service Vulnerabilities

The following exploits are available:

• /data/vulnerabilities/exploits/33258-1.py
• /data/vulnerabilities/exploits/33258-2.py

IBM DB2 Remote Denial of Service Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.

IBM DB2 Remote Denial of Service Vulnerabilities

References:

• Fixes by version for DB2 for Linux, UNIX and Windows (IBM)
  
• IBM DB2 (Dennis Yurichev)
  
• Security and HIPER APARs fixed in DB2 for Linux, UNIX, and Windows Version 9.1 (IBM)
  
• IBM DB2 (Dennis Yurichev )
  
• Security and HIPER APARs fixed in DB2 for Linux, UNIX, and Windows Version 8 Fix (IBM)